-stable review patch. If anyone has any objections, please let us know.
------------------
When an inbound PPTP_IN_CALL_REQUEST packet is received the
PPTP NAT helper uses a NULL pointer in pointer arithmentic to
calculate the offset in the packet which needs to be mangled
and corrupts random memory or crashes.
Signed-off-by: Patrick McHardy <[email protected]>
Signed-off-by: Chris Wright <[email protected]>
---
net/ipv4/netfilter/ip_nat_helper_pptp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- linux-2.6.15.y.orig/net/ipv4/netfilter/ip_nat_helper_pptp.c
+++ linux-2.6.15.y/net/ipv4/netfilter/ip_nat_helper_pptp.c
@@ -315,7 +315,7 @@ pptp_inbound_pkt(struct sk_buff **pskb,
break;
case PPTP_IN_CALL_REQUEST:
/* only need to nat in case PAC is behind NAT box */
- break;
+ return NF_ACCEPT;
case PPTP_WAN_ERROR_NOTIFY:
pcid = &pptpReq->wanerr.peersCallID;
break;
--